?? lion-petut-c06.htm
字號:
<li><font size="2">轉至數據目錄的第二個成員提取其</font><font
color="#FFFFCC" size="2" face="MS Sans Serif"><b>VirtualAddress</b></font><font
size="2">值。</font></li>
<li><font size="2">利用上值定位第一個 </font><font
color="#CCFFCC" size="2" face="MS Sans Serif"><b>IMAGE_IMPORT_DESCRIPTOR</b></font><font
size="2" face="MS Sans Serif"> </font><font size="2">結構。</font></li>
<li><font size="2">檢查 </font><font color="#FFFFCC"
size="2" face="MS Sans Serif"><b>OriginalFirstThunk</b></font><font
size="2">值。若不為</font><font size="2"
face="MS Sans Serif">0</font><font size="2">，順著 </font><font
color="#FFFFCC" size="2" face="MS Sans Serif"><b>OriginalFirstThunk</b></font><font
size="2" face="MS Sans Serif"> </font><font size="2">里的</font><font
size="2" face="MS Sans Serif">RVA</font><font size="2">值轉入那個</font><font
size="2" face="MS Sans Serif">RVA</font><font size="2">數組。若
</font><font color="#FFFFCC" size="2"
face="MS Sans Serif"><b>OriginalFirstThunk</b></font><font
size="2" face="MS Sans Serif"> </font><font size="2">為</font><font
size="2" face="MS Sans Serif">0</font><font size="2">，就改用</font><font
color="#FFFFCC" size="2" face="MS Sans Serif"><b>FirstThunk</b></font><font
size="2">值。有些連接器生成</font><font size="2"
face="MS Sans Serif">PE</font><font size="2">文件時會置</font><font
color="#FFFFCC" size="2" face="MS Sans Serif"><b>OriginalFirstThunk</b></font><font
size="2">值為</font><font size="2" face="MS Sans Serif">0</font><font
size="2">，這應該算是個</font><font size="2"
face="MS Sans Serif">bug</font><font size="2">。不過為了安全起見，我們還是檢查
</font><font color="#FFFFCC" size="2"
face="MS Sans Serif"><b>OriginalFirstThunk</b></font><font
size="2">值先。</font></li>
<li><font size="2">對于每個數組元素，我們比對元素值是否等于</font><font
color="#CCFFCC" size="2" face="MS Sans Serif"><b>IMAGE_ORDINAL_FLAG32</b></font><font
color="#CCFFCC" size="2"><b>。</b></font><font size="2">如果該元素值的最高二進位為</font><font
size="2" face="MS Sans Serif">1</font><font size="2">，
那么函數是由序數引入的，可以從該值的低字節提取序數。</font></li>
<li><font size="2">如果元素值的最高二進位為</font><font
size="2" face="MS Sans Serif">0</font><font size="2">，就可將該值作為</font><font
size="2" face="MS Sans Serif">RVA</font><font size="2">轉入
</font><font color="#CCFFCC" size="2"
face="MS Sans Serif"><b>IMAGE_IMPORT_BY_NAME</b></font><font
size="2"> 數組，跳過 </font><font color="#FFFFCC"
size="2" face="MS Sans Serif"><b>Hint</b></font><font
size="2" face="MS Sans Serif"> </font><font size="2">就是函數名字了。</font></li>
<li><font size="2">再跳至下一個數組元素提取函數名一直到數組底部</font><font
size="2" face="MS Sans Serif">(</font><font size="2">它以</font><font
size="2" face="MS Sans Serif">null</font><font size="2">結尾</font><font
size="2" face="MS Sans Serif">)</font><font size="2">。現在我們已遍歷完一個</font><font
size="2" face="MS Sans Serif">DLL</font><font size="2">的引入函數，接下去處理下一個</font><font
size="2" face="MS Sans Serif">DLL</font><font size="2">。</font></li>
<li><font size="2">即跳轉到下一個 </font><font
color="#CCFFCC" size="2" face="MS Sans Serif"><b>IMAGE_IMPORT_DESCRIPTOR</b></font><font
size="2" face="MS Sans Serif"> </font><font size="2">并處理之，如此這般循環直到數組見底。</font><font
size="2" face="MS Sans Serif">(</font><font
color="#CCFFCC" size="2" face="MS Sans Serif"><b>IMAGE_IMPORT_DESCRIPTOR</b></font><font
size="2" face="MS Sans Serif"> </font><font size="2">數組以一個全</font><font
size="2" face="MS Sans Serif">0</font><font size="2">域元素結尾</font><font
size="2" face="MS Sans Serif">)</font><font size="2">。</font></li>
</ol>
<h3>示例<font face="Arial, Helvetica, sans-serif">:</font></h3>
<p><font size="2">本例程打開一</font><font size="2"
face="MS Sans Serif">PE</font><font size="2">文件，將所有引入函數名讀入一編輯控件，同時顯示
</font><font color="#CCFFCC" size="2" face="MS Sans Serif"><b>IMAGE_IMPORT_DESCRIPTOR</b></font><font
size="2" face="MS Sans Serif"> </font><font size="2">結構各域值。</font></p>
<p><font face="Fixedsys">.386 <br>
.model flat,stdcall <br>
option casemap:none <br>
include \masm32\include\windows.inc <br>
include \masm32\include\kernel32.inc <br>
include \masm32\include\comdlg32.inc <br>
include \masm32\include\user32.inc <br>
includelib \masm32\lib\user32.lib <br>
includelib \masm32\lib\kernel32.lib <br>
includelib \masm32\lib\comdlg32.lib <br>
<br>
IDD_MAINDLG equ 101 <br>
IDC_EDIT equ 1000 <br>
IDM_OPEN equ 40001 <br>
IDM_EXIT equ 40003 <br>
<br>
DlgProc proto :DWORD,:DWORD,:DWORD,:DWORD <br>
ShowImportFunctions proto :DWORD <br>
ShowTheFunctions proto :DWORD,:DWORD <br>
AppendText proto :DWORD,:DWORD <br>
<br>
SEH struct <br>
PrevLink dd ? ; the address of the previous seh structure <br>
CurrentHandler dd ? ; the address of the new exception handler <br>
SafeOffset dd ? ; The offset where it's safe to continue
execution <br>
PrevEsp dd ? ; the old value in esp <br>
PrevEbp dd ? ; The old value in ebp <br>
SEH ends <br>
<br>
.data <br>
AppName db "PE tutorial no.6",0 <br>
ofn OPENFILENAME <> <br>
FilterString db "Executable Files (*.exe,
*.dll)",0,"*.exe;*.dll",0 <br>
db "All Files",0,"*.*",0,0 <br>
FileOpenError db "Cannot open the file for reading",0 <br>
FileOpenMappingError db "Cannot open the file for memory
mapping",0 <br>
FileMappingError db "Cannot map the file into memory",0
<br>
NotValidPE db "This file is not a valid PE",0 <br>
CRLF db 0Dh,0Ah,0 <br>
ImportDescriptor db 0Dh,0Ah,"================[
IMAGE_IMPORT_DESCRIPTOR ]=============",0 <br>
IDTemplate db "OriginalFirstThunk = %lX",0Dh,0Ah <br>
db
"TimeDateStamp = %lX",0Dh,0Ah <br>
db
"ForwarderChain = %lX",0Dh,0Ah <br>
db
"Name = %s",0Dh,0Ah <br>
db
"FirstThunk = %lX",0 <br>
NameHeader db 0Dh,0Ah,"Hint Function",0Dh,0Ah <br>
db
"-----------------------------------------",0 <br>
NameTemplate db "%u %s",0 <br>
OrdinalTemplate db "%u (ord.)",0 <br>
<br>
.data? <br>
buffer db 512 dup(?) <br>
hFile dd ? <br>
hMapping dd ? <br>
pMapping dd ? <br>
ValidPE dd ? <br>
<br>
.code <br>
start: <br>
invoke GetModuleHandle,NULL <br>
invoke DialogBoxParam, eax, IDD_MAINDLG,NULL,addr DlgProc, 0 <br>
invoke ExitProcess, 0 <br>
<br>
DlgProc proc hDlg:DWORD, uMsg:DWORD, wParam:DWORD, lParam:DWORD <br>
.if uMsg==WM_INITDIALOG <br>
invoke
SendDlgItemMessage,hDlg,IDC_EDIT,EM_SETLIMITTEXT,0,0 <br>
.elseif uMsg==WM_CLOSE <br>
invoke EndDialog,hDlg,0 <br>
.elseif uMsg==WM_COMMAND <br>
.if lParam==0 <br>
mov eax,wParam <br>
.if ax==IDM_OPEN <br>
invoke ShowImportFunctions,hDlg <br>
.else ; IDM_EXIT <br>
invoke
SendMessage,hDlg,WM_CLOSE,0,0 <br>
.endif <br>
.endif <br>
.else <br>
mov eax,FALSE <br>
ret <br>
.endif <br>
mov eax,TRUE <br>
ret <br>
DlgProc endp <br>
<br>
SEHHandler proc uses edx pExcept:DWORD, pFrame:DWORD,
pContext:DWORD, pDispatch:DWORD <br>
mov edx,pFrame <br>
assume edx:ptr SEH <br>
mov eax,pContext <br>
assume eax:ptr CONTEXT <br>
push [edx].SafeOffset <br>
pop [eax].regEip <br>
push [edx].PrevEsp <br>
pop [eax].regEsp <br>
push [edx].PrevEbp <br>
pop [eax].regEbp <br>
mov ValidPE, FALSE <br>
mov eax,ExceptionContinueExecution <br>
ret <br>
SEHHandler endp <br>
<br>
ShowImportFunctions proc uses edi hDlg:DWORD <br>
LOCAL seh:SEH <br>
mov ofn.lStructSize,SIZEOF <br>
ofn mov ofn.lpstrFilter, OFFSET FilterString <br>
mov ofn.lpstrFile, OFFSET buffer <br>
mov ofn.nMaxFile,512 <br>
mov ofn.Flags, OFN_FILEMUSTEXIST or OFN_PATHMUSTEXIST or
OFN_LONGNAMES or OFN_EXPLORER or OFN_HIDEREADONLY <br>
invoke GetOpenFileName, ADDR ofn <br>
.if eax==TRUE <br>
invoke CreateFile, addr buffer, GENERIC_READ,
FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL
<br>
.if eax!=INVALID_HANDLE_VALUE <br>
mov hFile, eax <br>
invoke CreateFileMapping, hFile,
NULL, PAGE_READONLY,0,0,0 <br>
.if eax!=NULL <br>
mov hMapping, eax <br>
invoke
MapViewOfFile,hMapping,FILE_MAP_READ,0,0,0 <br>
.if eax!=NULL <br>
mov
pMapping,eax <br>
assume
fs:nothing <br>
push
fs:[0] <br>
pop
seh.PrevLink <br>
mov
seh.CurrentHandler,offset SEHHandler <br>
mov
seh.SafeOffset,offset FinalExit <br>
lea
eax,seh <br>
mov
fs:[0], eax <br>
mov
seh.PrevEsp,esp <br>
mov
seh.PrevEbp,ebp <br>
mov edi,
pMapping <br>
assume
edi:ptr IMAGE_DOS_HEADER <br>
.if
[edi].e_magic==IMAGE_DOS_SIGNATURE <br>
add edi, [edi].e_lfanew <br>
assume edi:ptr IMAGE_NT_HEADERS <br>
.if [edi].Signature==IMAGE_NT_SIGNATURE <br>
mov
ValidPE, TRUE <br>
.else
<br>
mov ValidPE, FALSE <br>
.endif <br>
.else <br>
mov ValidPE,FALSE <br>
.endif <br>
FinalExit: <br>
push
seh.PrevLink <br>
pop fs:[0]
<br>
.if
ValidPE==TRUE <br>
invoke ShowTheFunctions, hDlg, edi <br>
.else <br>
invoke MessageBox,0, addr NotValidPE, addr AppName,
?? 快捷鍵說明
復制代碼
Ctrl + C
搜索代碼
Ctrl + F
全屏模式
F11
切換主題
Ctrl + Shift + D
顯示快捷鍵
?
增大字號
Ctrl + =
減小字號
Ctrl + -